Unpatched Check Point gateways hit with PHP2Shell and a wiper
After a late-October fix, attackers used PHP2Shell then CVE-2026-123039, deployed TSGA, and wiped some Israeli ESXi hosts.
86
Vulnerability1 · 1 read
CVE-2026-123039
Local root command execution via Gaia OS DynamicCLI socket
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Check Point Gaia OS DynamicCLI runs as root and listens on the world-writable local socket /tmp/dynamic_socket without checking which process connects. Any authenticated local user can send a command over that socket and have it run as root, gaining full control of the system. No affected or fixed builds are listed.
What to do: Apply Check Point's update for CVE-2026-123039. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Check Point Gaia OS DynamicCLI | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
- Weakness
- CWE-732, CWE-862
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesCheck Point says a firewall privilege-escalation flaw is exploited
Canada’s Cyber Centre urges admins to apply updates for CVE-2026-123039 and a separate Gaia Portal flaw.
74